CVE-2016-10815

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs SEC-120...

CVE-2016-10816

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders SEC-121...

CVE-2016-10816

CVE-2016-10816 affects cPanel prior to 57.9999.54, where Webmail accounts can execute arbitrary code via forwarders. Public sources confirm the issue exists in these versions; Red Hat, CNVD, and CVE listings corroborate the vulnerability description. The root cause and affected scope are tied to ...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

Default credentials

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10859

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

CVE-2016-10859

CVE-2016-10859 affects cPanel before 11.54.0.0. The issue allows unauthorized password changes through Webmail API commands (SEC-65). Root cause details are not expanded beyond the description in the provided documents. Exploitation status and concrete remediation steps are not specified in the c...

CVE-2019-14387

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...

CVE-2019-14387

CVE-2019-14387 affects cPanel before 82.0.2, with a Self XSS vulnerability in the cPanel and webmail master templates (SEC-506). Root cause is client-side script execution via crafted input in template code. Impact, per CVSS data, is MEDIUM: network access with exploitation requiring user interac...

CVE-2019-14387

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates SEC-506...

MDaemon Webmail Cross-Site Request Forgery Vulnerability

MDaemon Technologies MDaemon Webmail formerly known as WorldClient is a Web-based e-mail client for MDaemon Email Server from MDaemon Technologies. A cross-site request forgery vulnerability exists in MDaemon Webmail. The vulnerability stems from a WEB application that does not adequately validat...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

Cross site request forgery (csrf)

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792

MDaemon Webmail formerly WorldClient has CSRF...

CVE-2018-17792

CVE-2018-17792 affects MDaemon Webmail (WorldClient). It is a Cross-Site Request Forgery (CSRF) in the web client. Exploitation could perform unintended actions for an authenticated user; CVSS2 base score 6.8 (MEDIUM) and CVSS3 base score 8.8 (HIGH) with network access, low attack complexity, no ...

SquirrelMail 1.4.22 Cross Site Scripting

Advisory ID: SYSS-2019-016 Product: SquirrelMail Manufacturer: The SquirrelMail Project Affected Versions: 1.4.22, SVN Tested Versions: SVN Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Open Manufacturer Notification: 2019-04-17 Solution Date: N/A Public...

CVE-2019-12938

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI...

CVE-2019-12938

The CVE-2019-12938 entry concerns Analogic Poste.io 2.1.6, specifically the Roundcube component. The root issue is that .htaccess protection used to guard the logs/ folder is effective with Apache but not with nginx, enabling attackers to access logs through the webmail/logs/sendmail URI. Red Hat...